Java exception with pipeline rule to calculate diff between two millisecond date values

Graylog Central (peer support)
1

So I’m really scratching my head on this one. My goal is to take a timestamp I have pulled from a prior message that shares the same value on a field, store that in a lookup table, pull said timestamp from the lookup table using the field value, and then calculate the interval between the two timestamps and assign that value to a field. But whenever I try to calculate the offset, I get the following Processing Error message:

an exception was thrown: java.lang.Long cannot be cast to java.lang.Double

Pipeline rule configured as such

rule "RTC-2:REST Alert-> Pop Time"
when
    contains(to_string($message.message), "Pop Time", true)
then
    let rct = lookup_value("rubycalltrack", ($message.RubyCallID));
    set_field ("rcid_interval", (
        parse_date(
            value: to_string(
                rct), 
            pattern: "yyyy-MM-dd'T'HH:mm:ss.SSSZ", 
            locale:"en_US")
        .millis) -
        parse_date(
            value: to_string(
                $message.timestamp), 
            pattern: "yyyy-MM-dd'T'HH:mm:ss.SSSZ", 
            locale:"en_US" )
        .millis);
    lookup_set_value ("rubycalltrack", to_string($message.RubyCallID), $message.timestamp);
end

And in just testing it now, I get the Processing Error

Error evaluating action for rule <RTC-2:REST Alert-> Pop Time/61f50de9876cfa3b78005fd9> (pipeline <Ruby Call Tracking Pipeline/61f51b43876cfa3b780070d4>) - In call to function 'set_field' at 6:4 an exception was thrown: java.lang.Long cannot be cast to java.lang.Double

I do know that the value is being properly pulled from the lookup table and is read with correct data type of date, as I previously had a line in the rule that set the older timestamp to a field and then used that field in the parse_date function, and the field was set properly with type date. But the math function always kicks the cast java error.

Any help is greatly appreciated.

2

Nothing stands out, looks like you have been thorough… Maybe break it out to it’s parts (rather than one big set_field()) and use the debug() function to watch the results of each part happen…

rule "RTC-2:REST Alert-> Pop Time"
when
    contains(to_string($message.message), "Pop Time", true)
then
    let rct   = lookup_value("rubycalltrack", ($message.RubyCallID));
//
debug(concat("++++ rct:",to_string(rct)));
//
    let date1 = parse_date(
                    value:      to_string(rct), 
                    pattern:    "yyyy-MM-dd'T'HH:mm:ss.SSSZ", 
                    locale:     "en_US").millis;
//                    
debug(concat("++++ date1:",to_string(date1)));
//
    let date2 = parse_date(
                    value:      to_string($message.timestamp), 
                    pattern:    "yyyy-MM-dd'T'HH:mm:ss.SSSZ", 
                    locale:     "en_US").millis;
//
debug(concat("++++ date2:",to_string(date2)));
//
    let the_diff = date1 -date2;
//
debug(concat("++++ the_diff:",to_string(the_diff)));
//
    set_field("rcid_interval", the_diff);
//
debug(concat("++++ rcid_interval:",to_string($message.rcid_interval)));  //may not pick this up since it was just set
//
    lookup_set_value ("rubycalltrack", to_string($message.RubyCallID), $message.timestamp);
end

watch with:

tail -f /var/log/graylog-server/server.log

1 Like
3

Thanks for all this! Unfortunately, it throws the same error:

(Error: At 23:19 an exception was thrown: java.lang.Long cannot be cast to java.lang.Double)

Which is the let the_diff = date1 -date2; function. It almost seems like the math function in the pipeline rule code is overriding any set type and always making the first value be a float/double and the second value always be an int/long.

4

How about:

let the_diff = to_long(date1) - to_long(date2)

I

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.